Here, we demonstrate using an automated Search for Natural Adversarial Features Using Embeddings (SNAFUE) to find novel combinations of natural features that fool DNNs.
We apply SNAFUE to make targeted copy/paste attacks for an image classifier in which one natural image is inserted as a patch into another to induce an unexpected misclassification.
Figure REF  outlines our approach.
First, we use a generator to synthesize robust feature-level adversarial patches [1]} which are designed to make any image from a source class misclassified as a target.
Second, we use the target model's latent activations to create embeddings of both these synthetic patches and a dataset of natural patches.
Finally we select the natural patches that are the most similar to the synthetic ones.
